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REMARKS 

In the non-final Office Action, the Examiner rejects claims 1-2, 9-12, 16, 17, 19, 
20, 21 and 23-26 under 35 U.S.C. § 102(e) as being anticipated by COOPER et al. (U.S. 
Patent Application Publication No. 2004/0039942); rejects claims 3-6, 15, 18 and 22 
under 35 U.S.C. § 103(a) as being unpatentable over COOPER et al. in view of 
HADDOCK et al. (U.S. Patent No. 6,678,248); and rejects claims 7-8 under 35 U.S.C. § 
103(a) as being unpatentable over COOPER et al. in view of WESTERINEN (U.S. Patent 
No. 6,119,185). Applicant respectfully traverses the above-note grounds of rejection. 1 

By way of this Amendment, claims 13, 14, 20, 25, and 26 have been canceled 
without prejudice or disclaimer and claims 10, 19, and 21 have been amended to improve 
form. Accordingly, claims 1-12 and 15-19, and 21-24 are now pending in the present 
application. Reconsideration and allowance of all claims 1-12 and 15-19, and 21-24 in 
view of the preceding Amendments and the following Remarks are respectfully 
requested. 

Rejections Under 35 U.S.C. § 102(e) 

Claims 1-2, 9-12, 16, 17, 19, 21, 23, and 24 have been rejected under 35 U.S.C. § 
102(e) as being anticipated by COOPER et al. (U.S. Patent Application Publication No. 
2004/0039942). Applicant respectfully traverses this rejection. 



1 As Applicant's remarks with respect to the Examiner's rejections are sufficient to overcome these rejections, 
Applicant's silence as to assertions by the Examiner in the Office Action or certain requirements that may be applicable 
to such rejections (e.g., whether a reference constitutes prior art, motivation to combine references, etc.) is not a 
concession by Applicant that such assertions are accurate or such requirements have been met, and Applicant reserves 
the right to analyze and dispute such assertions/requirements in the future. 
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A proper rejection under 35 U.S.C. §102 requires that a single reference teach 
every aspect of the claimed invention either expressly or impliedly. Any feature not 
directly taught must be inherently present. In other words, the identical invention must 
be shown in as complete as contained in the claim. See M.P.E.P §2131. COOPER et al. 
does not disclose or suggest the combination of features recited in claims 1-2, 9-14, 16- 
17, 19-21 and 23-26. 

For example, independent claim 1 is directed to a method of analyzing policy 
rules defined for a subscriber and determining packet treatment, the method including 
retrieving definitions pertaining to policy rules for a subscriber; determining at least one 
policy point in a network for the subscriber based on the retrieved definitions; 
determining the packet treatment at each of the at least one policy point; and outputting 
information corresponding to the packet treatment for each of the at least one policy 
point. COOPER et al. does not disclose or suggest the combination of features recited in 
claim 1. 

More specifically, COOPER et al. does not disclose or suggest determining at 
least one policy point in a network for a subscriber based on the retrieved definitions , as 
recited in claim 1. In rejecting claim 1, the Examiner cited page 9, paragraph [0207] of 
COOPER et al. for allegedly disclosing this feature (Office Action - pg. 2). Applicant 
respectfully disagrees with the Examiner's interpretation of COOPER et al. 

At page 9, paragraph [0207], COOPER et al. discloses: 

The Monitoring Point is a specification of where the Input dump file was 
collected. This name is derived from policy domain names that are specified in 
the policy wizard. For example, if a packet dump was collected in a policy 
domain named "Intranet" then the Monitoring Point name 
INTRANET_MONITOR should be used. 
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This section of COOPER et al. discloses that the point at which the input packet dump 
file was collected is named based on the policy domain in which the policy is being 
application. This section of COOPER et al. does not disclose determining at least one 
policy point in a network for the subscriber based on the retrieved definitions, as required 
by claim 1. Rather, this section of COOPER et al. merely discloses assigning a name to 
the dump location from which packet data is collected, with the name being selected 
based on the policy domain being affected. Thus, the specification of the monitoring 
point is based on a user input of this information. Clearly, the collection point of 
COOPER et al. is not identified within the network for the subscriber based on the 
retrieved definitions , as required by claim 1 . 

For at least this reason, claim 1 is not anticipated by COOPER et al. 
Reconsideration and withdrawal of the rejection of claim 1 are respectfully requested. 

Claims 2 and 9 depend from claim 1 and are therefore not anticipated by 
COOPER et al. for at least the reasons set forth above with respect to claim l. 2 
Moreover, these claims are not anticipated by COOPER et al. for reasons of their own. 

For example, COOPER et al. does not disclose or suggest consolidating the 
determined packet treatment for each of the at least one policy points, as required by 
claim 2. In rejecting claim 2, the Examiner indicates that page 14, paragraph [0292] of 
COOPER et al. allegedly discloses this feature (Office Action - pg. 3). Applicant 
respectfully disagrees. 

At page 14, paragraph [0292], COOPER et al. discloses: 

2 As Applicant's remarks with respect to the base independent claims are sufficient to overcome the Examiner's 
rejections of all claims dependent therefrom, Applicant's silence as to the Examiner's assertions with respect to 
dependent claims is not a concession by Applicant to the Examiner's assertions as to these claims, and Applicant 
reserves the right to analyze and dispute such assertions in the future. 
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The wizard segregates all intradomain ICMP traffic (common on an enterprise 
network) by use of a rule that assigns it the disposition Monitor_Icmp. The rule is 
named by combining the protocol name with the domain name using the word 
_Within. For example, in the Intranet policy domain the rule is named 
Icmp_Within_Intranet. 

This section of COOPER et al. discloses a policy rule that assigns ICMP (Internet 

Control Message Protocol) traffic on the network to a predetermined disposition. As 

described at pg. 2, paragraph [0045], an event's "disposition determines whether the 

event is allowed, i.e. conforms to the specified policy or disallowed and what action, if 

any, should be taken by a system monitor in response to that event." This section of 

COOPER et al. does not disclose or even remotely suggest consolidating the determined 

packet treatment of each of the at least one policy points, as required by claim 2. In fact, 

COOPER et al. does not even discuss collecting packet data from a multiple policy 

points, let alone consolidating the treatment data. 

For at least this additional reason, claim 2 is not anticipated by COOPER et al. 
Reconsideration and allowance of claim 2 are respectfully requested. 

COOPER et al. likewise fails to disclose or suggest determining at least one 
injection point based on the at least one policy point; using at least one policy agent to 
inject packets at the at least one injection point; collecting statistics from some of the at 
least one policy agent, as required by claim 9. In rejecting claim 9, the Examiner 
indicated that page 9, paragraphs [0190] - [0207], page 14, paragraphs [0289] and 
[0292], and page 4, TABLE A of COOPER et al. allegedly disclose these features (Office 
Action - pg. 3). Applicant respectfully disagrees with the Examiner's interpretation of 
COOPER et al. 
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Page 14, paragraph [0289] of COOPER et al. discloses an agent descriptor 
"INTRANET_MONITOR." This section of COOPER et al. does not disclose 
determining at least one injection point based on the at least one policy point, as alleged 
by the Examiner. In fact, this section of COOPER et al. does not even relate to 
determining at least one injection point. As described in the present Specification at 
paragraph [0130], "[i]njection points are determined based on the policy points defined in 
policy and service definitions, and on the flow of packets. For example, when there is 
one policy point and the flow is bi-directional, two injection points are needed. One 
injection point injects traffic from the subscriber to the content server and the other 
injection point injects traffic from the content server to the subscriber." Clearly, the cited 
section of COOPER et al. does not relate to the injection points, as this term is recited in 
claim 9. 

Page 9, paragraphs [0190] to [0207] of COOPER et al. discloses that packet 
gathering component 128 collects packet data from network 125, converts it into a event 
data suitable for analysis by policy monitor 100, and forwards the event data to policy 
monitor 100. The event data may be either collected and distributed or may be streamed 
in real time. Policy monitor 100 may analyze the received event data and may transmit 
information about policy dispositions back to packet gathering component 128. This 
section of COOPER et al. does not disclose or even remotely suggest using at least one 
policy agent to inject packets at the at least one injection point, as required by claim 9. In 
fact, this section does not relate to injection points in any manner whatsoever. 

Page 4, TABLE A of COOPER et al. discloses a listing of network security 
terminology relating to policy monitoring. TABLE A does not disclose or even remotely 
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suggest collecting statistics from one of the at least one policy agent, as alleged by the 
Examiner. In fact, TABLE A does not even relate to a policy agent to inject packets at 
the at least one injection point. 

For at least these additional reasons, claim 9 is not anticipated by COOPER et al. 
Reconsideration and allowance of claim 9 are therefore respectfully requested. 

Independent claim 10, as amended, recites features similar to (yet possibly 
different in scope than) those set forth above with respect to claim 1. Accordingly, claim 
10 is not anticipated by COOPER et al. for at least reasons similar to those set forth 
above with respect to claim 1. Reconsideration and allowance of claim 10 are 
respectfully requested. 

Claims 11, 12, 15, 16, and 17 depend from claim 10 and are therefore not 
anticipated by COOPER et al. for at least the reasons set forth above with respect to 
claim 10. Moreover, these claims are not anticipated by COOPER et al. for reasons of 
their own. 

For example, COOPER et al. does not disclose the one or more devices are 
configured to command, via the agent interface, one or more agents to inject packets into 
a network, as required by claim 17. In rejecting claim 17, the Examiner indicated that 
page 6, paragraph [0108] of COOPER et al. allegedly disclose this feature (Office Action 
- pg. 5). Applicant respectfully disagrees. 

At page 6, paragraph [0108], COOPER et al. discloses: 

In another embodiment of the invention, the network monitor 127 can read packet 
data directly from observed network 125, generating a continuous stream of event 
updates for the policy monitor 100. This stream operates in real-time so that the 
policy monitor 100 processes events shortly after they happen on observed 
network 125. 
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This section of COOPER et al. discloses that collected packet data may be streamed from 
the observed network to policy monitor 100. This section of COOPER et al. does not 
disclose one or more devices are configured to command, via the agent interface, one or 
more agents to inject packets into a network, as required by claim 17. In fact this section 
of COOPER et al. does not even relate to injecting packets into a network. 

For at least this additional reason, claim 17 is not anticipated by COOPER et al. 
Reconsideration and allowance are respectfully requested. 

Independent claim 19, as amended, recites a system for analyzing packet 
treatment in a network including a management server configured to load policy rules 
and service definitions to a router when a subscriber session is established; a database 
including definitions of policy rules, the service definitions, and a network configuration, 
the database being configured to be accessible by the management server; a policy 
analyzer configured to analyze packet treatment based on ones of the policy rules and the 
service definitions defined for a subscriber, the policy analyzer being configured to 
access the management server and the database; a policy analyzer agent configured to 
receive commands from the policy analyzer to inject packets into a network at an 
injection point; and a user input/output interface configured to provide input to the policy 
analyzer and receive analysis results from the policy analyzer. COOPER et al. does not 
disclose or suggest the features of claim 19. 

For example, COOPER et al. does not disclose or suggest a policy analyzer agent 
configured to receive commands from the policy analyzer to inject packets into a network 
at an injection point. The above-recited feature of claim 19 was initially recited in 
originally filed claim 20. In rejecting original claim 20, the Examiner indicated that page 
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9, paragraphs [0188] - [0199] of COOPER et al. allegedly disclose this feature (Office 
Action - pg. 6). Applicant respectfully disagrees. 

Page 9, paragraphs [0188] - [0199] of COOPER et al. discloses that packet 
gathering component 128 collects packet data from network 125, converts it into a event 
data suitable for analysis by policy monitor 100, and forwards the event data to policy 
monitor 100. The event data may be either collected and distributed or may be streamed 
in real time. Policy monitor 100 may analyze the received event data and may transmit 
information about policy dispositions back to packet gathering component 128. This 
section of COOPER et al. does not disclose or even remotely suggest a policy analyzer 
agent configured to receive commands from the policy analyzer to inject packets into a 
network at an injection point, as required by claim 19. In fact, this section does not relate 
to injection points in any manner whatsoever. 

For at least this reason, claim 19 is not anticipated by COOPER et al. 
Reconsideration and withdrawal of the rejection of claim 19 are respectfully requested. 

Claims 21 and 22 depend from claim 19 and are therefore not anticipated by 
COOPER et al. for at least the reasons set forth above with respect to claim 19. 
Reconsideration and withdrawal of the rejection of claims 21 and 22 are respectfully 
requested. 

Independent claim 23, as amended, recites one or more network devices including 
an analyzer interface configured to receive commands from a policy analyzer and send 
information to the policy analyzer; an injector for injecting traffic into a network upon 
receiving a command from the policy analyzer via the analyzer interface; and a statistics 
module configured to collect statistics of the injected traffic, the statistics module being 
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further configured to send the collected statistics to a policy analyzer via the analyzer 
interface. COOPER et al. does not disclose or suggest the features of claim 23. 

For example, COOPER et al. does not disclose or suggest an injector for injecting 
traffic into a network upon receiving a command from the policy analyzer via the 
analyzer interface. This feature of claim 23 was initially recited in original claim 25. In 
rejecting claim 25, the Examiner indicated that page 6, paragraph [0108] of COOPER et 
al. allegedly discloses this feature (Office Action - pg. 7). Applicant respectfully 
disagrees with the Examiner's interpretation of COOPER et al. 

At page 6, paragraph [0108], COOPER et al. discloses: 

In another embodiment of the invention, the network monitor 127 can read packet 
data directly from observed network 125, generating a continuous stream of event 
updates for the policy monitor 100. This stream operates in real-time so that the 
policy monitor 100 processes events shortly after they happen on observed 
network 125. 

This section of COOPER et al. discloses that collected packet data may be streamed from 
the observed network to policy monitor 100. This section of COOPER et al. does not 
disclose an injector for injecting traffic into a network upon receiving a command from 
the policy analyzer via the analyzer interface, as required by claim 23. In fact this section 
of COOPER et al. does not even relate to injecting packets into a network. 

For at least this reason, claim 23 is not anticipated by COOPER et al. 
Reconsideration and allowance are respectfully requested. 

Claim 24 depends from claim 23 and is therefore not anticipated by COOPER et 
al. for at least the reasons set forth above with respect to claim 23. Reconsideration and 
withdrawal of the rejection of claim 24 are respectfully requested. 
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Rejections Under 35 U.S.C. § 103(a) 

Claims 3-6, 15, 18 and 22 have been rejected under 35 U.S.C. § 103(a) as being 
unpatentable over COOPER et al. in view of HADDOCK et al. Applicant respectfully 
traverses this rejection. 

Claims 3-6 depend from claim 1. The disclosure of HADDOCK et al. does not 
remedy the deficiencies in the disclosure of COOPER et al. noted above with respect to 
claim 1. Accordingly, claims 3-6 are allowable over the combination of COOPER et al. 
and HADDOCK et al. for at least the reasons set forth above with respect to claim 1. 

Claims 15 and 18 depend from claim 10. The disclosure of HADDOCK et al. 
does not remedy the deficiencies in the disclosure of COOPER et al. noted above with 
respect to claim 10. Accordingly, claims 15 and 18 are allowable over the combination 
of COOPER et al. and HADDOCK et al. for at least the reasons set forth above with 
respect to claim 10. 

Claim 22 depends from claim 19. The disclosure of HADDOCK et al. does not 
remedy the deficiencies in the disclosure of COOPER et al. noted above with respect to 
claim 19. Accordingly, claim 22 is allowable over the combination of COOPER et al. 
and HADDOCK et al. for at least the reasons set forth above with respect to claim 19. 

Claims 7 and 8 have been rejected under 35 U.S.C. § 103(a) as being unpatentable 
over COOPER et al. in view of WESTERINEN. Applicant respectfully traverses this 
rejection. 

Claims 7 and 8 depend from claim 1. The disclosure of WESTERINEN does not 
remedy the deficiencies in the disclosure of COOPER et al. noted above with respect to 
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claim 1. Accordingly, claims 3-6 are allowable over the combination of COOPER et al. 

and WESTERINEN for at least the reasons set forth above with respect to claim 1 

To the extent necessary, a petition for an extension of time under 37 C.F.R. § 

1.136 is hereby made. Please charge any shortage in fees due in connection with the 

filing of this paper, including extension of time fees, to Deposit Account No. 50-1070 

and please credit any excess fees to such deposit account. 

Respectfully submitted, 
Harrity Snyder, L.L.P. 

By: /Robin C. Clark/ 

Robin C. Clark 
Registration No. 40,956 

Date: March 30, 2007 

1 1350 Random Hills Road 
Suite 600 

Fairfax, Virginia 22030 
(571)432-0800 

Customer Number: 44989 



